The pdnsd Homepage

News

2012-03-17	Version 1.2.9a-par has been released. Version 1.2.9a fixes a bug in the 1.2.9 release that causes a build failure when pdnsd is configured with `--enable-strict-rfc2181`. If you do not use this option to compile pdnsd, there is no need to upgrade from 1.2.9 to 1.2.9a.
2012-02-27	Version 1.2.9-par has been released. Version 1.2.9 supports many more RR types (including those necessary for DNSSEC) and EDNS (Extension mechanisms for DNS) to enable UDP messages larger than 512 bytes. It also has support for defining local TXT records and has several new options and bugfixes (including file descriptor leaks that effect FreeBSD users).
2011-05-03	The latest source code is available from a git repository. In response to frequent requests I have uploaded a git tree including the latest code and a fairly extensive history of pdnsd development to gitorious.org. Anyone who wants to participate in pdnsd development is free to create a clone repo on gitorious.org and push his modifications there.
2010-02-22	Version 1.2.8-par has been released. The main new feature of version 1.2.8 is automatic discovery of root servers. Furthermore, there are some additional improvements in the resolver.
2008-09-04	Version 1.2.7-par has been released. Foremost, this release fixes some security problems. It contains a fix for a "dangling pointer" bug that could cause pdnsd to crash when it received a long reply. It also addresses some of the issues raised in the CERT vulnerability note VU#800113 by making the default of `query_port_start` equal to 1024, thereby ensuring that source ports are randomly selected by the pdnsd resolver in the range 1024-65535. This release also fixes problems with compiling pdnsd for the ARM architecture and for the Darwin platform (Max OS X). There are a number of (minor) new features. pdnsd now supports "include" files, essentially configuration files that only contain definitions for local records. It is now possible to define interactively, using `pdnsd-ctl`, any local record that can be defined in a configuration file.
2007-09-04	Version 1.2.6-par has been released. pdnsd's license has been upgraded to GPL version 3. A bug has been fixed which which caused pdnsd to handle NXDOMAIN replies inefficiently when configured with `neg_domain_pol=on`. The code that implements the ping test has been fixed, which was broken for 64-bit systems. A new option `randomize_servers` can be used to give each server in a section of the configuration file an equal chance of being queried. The new options `reject`, `reject_policy` and `reject_recursively` make it possible to check for the presence of certain IP addresses in the replies of name servers and to avoid some types of unwanted replies. The pdnsd-ctl '`add a`' and '`add aaaa`' commands now allow multiple IP addresses to be specified for the same name. pdnsd's ability to resolve from root servers has been improved.
2006-09-02	Version 1.2.5-par has been released. This release introduces a new query method: `udp_tcp`. With this method a UDP query is tried first and, if the UDP answer is truncated, the query is repeated using TCP, which is the behaviour that seems to be recommended by the DNS standards. There is a new configuration option `use_nss`, which can be turned off to prevent lengthy timeouts and stalls in certain situations. A bug has been fixed which could cause pdnsd to crash if debug output was generated before the debug output stream was properly initialized.
2006-01-09	Version 1.2.4-par has been released. A memory leak and a minor buffer-overflow problem have been fixed. There is now a fix for some situations that would previously cause pdnsd to exit prematurely (such as ACPI S3 sleep or trying to attach strace to pdnsd). Time intervals specified in the configuration file can now be expressed in minutes, hours, days and weeks as well as seconds. Support for Apple Mac OS X v10.4 Tiger has been improved. The "`pdnsd-ctl status`" command now also provides some information about the status of the running threads. There are some further improvements in the debugging information provided by pdnsd. TCP-query support is now compiled in by default (but can still be disabled using the configure option `--disable-tcp-queries`).
2005-07-11	Version 1.2.3-par has been released. New feature in this release: the "`pdnsd-ctl empty-cache`" command can be provided with an include/exclude list, allowing the user to specify a selection of names to be removed, instead of emptying the cache completely. Additional improvements: pdnsd should now remain responsive while executing the "`pdnsd-ctl empty-cache`" command. With the `query_method=tcp_udp` option pdnsd will now also try a UDP query after a TCP connection times out, which should allow pdnsd to resolve the same names with `query_method=tcp_udp` as with `query_method=udp_only`, although perhaps with an occasional delay. "`pdnsd-ctl config`" or "`pdnsd-ctl server`" commands should now run without delays, even if pdnsd is performing `ping` or `query` uptests at the time. Some problems with resolving certain names using root servers have been fixed.
2005-04-03	Version 1.2.2-par has been released. The main emphasis of this release is improved portability. A bug has been fixed that prevented pdnsd from compiling successfully on some 64 bit architectures. This release has (experimental) support for the Darwin (Apple Mac OS X) platform. On Linux systems, the configure script will now try to detect automatically whether the system implements the Native POSIX Thread Library, but the method used may not necessarily be foolproof. In addition, the debug features have been improved and should make it easier to find out why pdnsd considers some queries or replies malformed.
2004-11-07	Version 1.2.1-par has been released. The main new feature of this release is improved support for non-Linux platforms. This release has (experimental) support for the Cygwin platform, and should also fix some compilation glitches that have been reported by FreeBSD users.
2004-10-10	Version 1.2-par has been released. pdnsd is new and improved! Most of the changes effect the internal workings of pdnsd, but there also a number of interesting new features (well, I think they are interesting). Among the bugs fixed are two rather nasty ones which involve the handling of NXT and NAPTR records and which can cause pdnsd to crash or abort. The new features include a new server availability test which can be specified with `uptest=query`, support for reading the DNS configuration from resolv.conf files, a new option for optimizing the use of root servers, a new option that makes defining local records for reverse resolving easier, support for defining wildcard records, a new pdnsd-ctl command for reloading the config file without restarting pdnsd, and a new pdnsd-ctl command for dumping information about the names stored in the cache. The documentation has also been updated: there is now a `pdnsd.conf` man page. For a more complete list of the changes I'll have to refer you to `README.par` and the `ChangeLog`.
2004-05-22	Version 1.1.11a-par has been released. This release contains a fix for FreeBSD users that bypasses a problem with the macro `ENONET`, which can cause a compilation failure when it is undefined. Linux users will notice no difference between 1.1.11a-par and 1.1.11-par.
2004-05-10	Version 1.1.11-par has been released. This version has a rather large number of small changes, which are rather difficult to summarize. Among the bugs fixed are a race condition in the cache lookup code, a flaw in the code that caused a busy spin when a remote server answered with "Not Implemented", and problems with the -4 and -6 command-line options. Among the improvements are an alternative sorting algorithm which should allow pdnsd to start up faster when reading a large cache file from disk, automatic mapping of IPv4 to IPv6 addresses when running in IPv6 mode, somewhat more efficient memory use, better compression of the replies and changes in the parallel querying algorithm that should improve the chances of catching a reply from a remote server. For a more complete list of the changes I'll have to refer you to `README.par` and the `ChangeLog`.
2004-02-10	Version 1.1.10-par has been released. The main new feature of this release is a new parser for configuration files, completely rewritten from scratch in C. The main advantages are: (f)lex and yacc/bison are no longer needed to build pdnsd, more informative error messages instead of merely "`parse error`", and string literals no longer need to be enclosed in quotes in most cases. Furthermore, a bug has been fixed that caused incorrect IPV6-type PTR records to be generated when sourcing `/etc/hosts` like files. There have been other small changes, more details can be found in the `ChangeLog`.
2004-01-08	Version 1.1.9-par has been released. "maintenance" release by Paul Rombouts. The change of version number is not very significant; the difference between 1.1.9-par and the previous 1.1.8b1-par8 is marginal. However, I felt the need to simplify the numbering, because it was becoming rather baroque. I've added some missing pieces to the documentation (the pdnsd manual and the man page for pdnsd-ctl). BTW, did you know that it's possible to define aliases for domain names with pdnsd? I had plans to implement such a feature when I discovered that pdnsd already supports it. It was just poorly documented. (If want to try this for your self, look for the new information about CNAME records under the rr Section in the manual.) The changes to the code consist mostly of optimizations, removal of some size limits due to fixed-size buffers, and some cleaning up. I've also tried to make the error responses of `pdnsd-ctl` more helpful. More details can be found in the `ChangeLog`.
2003-10-10	Version 1.1.8b1-par8 has been released. "maintenance" release by Paul Rombouts. This version introduces a "delegation-only" feature that may be useful for blocking Verisign's Sitefinder. The parser for the configuration file now tolerates domain names missing a dot at the end. I have provided alternative implementations for some GNU extensions that I used in an effort to make the code more portable. In particular, the code should build on FreeBSD again. More details can be found in the `README.par` file.
2003-09-19	Version 1.1.8b1-par7 has been released. "maintenance" release by Paul Rombouts. Besides fixing a number of bugs I have reworked some of the code for adding and removing entries in the cache in an effort to improve efficiency and stability. More details can be found in the `ChangeLog`.
2003-07-28	Version 1.1.8b1-par6 has been released. "maintenance" release by Paul Rombouts. In addition to some further code cleanup, the documentation has been revised.
2003-07-10	Version 1.1.8b1-par5 has been released. A troublesome allocation size error has been discovered in Thomas Moestl's code. In practice this bug only wastes memory but it could also potentially lead to memory corruption. Upgrading is recommended. More details can be found in the `ChangeLog`.
2003-06-30	Version 1.1.8b1-par4 has been released. Due to incompatibilities between various implementations of the pthread library on Linux systems, problems can occur with signal handling in pdnsd. The usual symptom is failure by pdnsd to save the cache to disk, and `/var/cache/pdnsd/pdnsd.cache` remaining empty. If you experience this kind of trouble, try reconfiguring with different values for the new `--with-thread-lib` option. The allowable values are described in the documentation.
2003-04-07	pdnsd is no longer maintained by Thomas Moestl: I have not had time to maintain pdnsd for quite a while now, and have been very slow to respond to issues, or did not respond at all. It is time that I officially announce that pdnsd is no longer actively maintained; I apologize to all those who reported bugs or asked questions without receiving any reply. However, Paul A. Rombouts has published a patch set against the last released version at http://members.home.nl/p.a.rombouts/pdnsd.html, which cleans up a lot of code fixes many bugs.
2002-07-19	Documentation update. Please note that pdnsd should never be installed with setuid or setgid attributes, as it is not always possible to give up all privileges due to operating system restrictions. While this was never intended and I don't think that anybody would actually do this, the documentation was updated to explicitely mention this to avoid misunderstandings.
2002-01-15	Version 1.1.7a has been released. This fixes a reversed test in an assertion that would cause pdnsd to termintate when the ping uptest was used. No other changes were made.
2002-01-15	Version 1.1.7 has been released. This fixes some problems that might be remotely exploitable to gain access as the user pdnsd runs as (an unprivileged user by default). To do this, an attacker needs to control a name server that is queried by pdnsd, and send a malicious reply to such a query. Upgrading is strongly recommended! There are also minor bug fixes and stability improvements.

About pdnsd

pdnsd is a proxy DNS server with permanent caching (the cache contents are written to hard disk on exit) that is designed to cope with unreachable or down DNS servers (for example in dial-in networking).
Since version 1.1.0, pdnsd supports negative caching.

It is licensed under the GNU General Public License (GPL, also available in html and translated into various languages.). This, in short, means that the sources are distributed togehter with the program, and that you are free to modify the sources and redistribute them as long as you also license them under the GPL. You do not need to pay anything for pdnsd. It also means that there is ABSOLUTELY NO WARRANTY for pdnsd or any part of it. For details, please read the GPL.

pdnsd can be used with applications that do DNS lookups, e.g. on startup, and can't be configured to change that behaviour, to prevent the often minute-long hangs (or even crashes) that result from stalled DNS queries. Some Netscape Navigator versions for Unix, for example, expose this behaviour.

pdnsd is configurable via a file and supports run-time configuration using the program pdnsd-ctl that comes with pdnsd. This allows you to set the status flags of servers that pdnsd knows (to influence which servers pdnsd will query), and the addition, deletion and invalidation of DNS records in pdnsd's cache.
Parallel name server queries are supported. This is a technique that allows querying several servers at the same time so that very slow or unavailable servers will not block the answer for one timeout interval.
Since version 1.0.0, pdnsd has full IPv6 support.

There is also a limited support for local zone records, intended for defining 1.0.0.127.in-addr.arpa. and localhost. , since some clients request that information and it must be served even if the cached servers are not available or do not serve these records. pdnsd may also read your /etc/hosts file (this file is normally used by your local resolver and usually contains information for localhost as well as for your machines FQDN) and serve its contents.

pdnsd was started on Linux, and has since been ported to FreeBSD (and Cygwin and Darwin). 90% of the source code should be easily portable to POSIX- and BSD-compatible systems, provided that those systems support the POSIX threads (pthreads). The rest might need OS-specific rewrites.

Currently, pdnsd is only compileable by gcc. This should be easy to fix, but I just do not have documentation for other compilers. If you are not able or do not want to use gcc, I would recommend you just try to do the minor changes.

pdnsd must be started as root in some cases (raw sockets are needed for icmp echoes for the option uptest=ping, and the default port is 53, this must be >1024 to allow non-root execution). However, pdnsd can be configured to change it's user and group id to those of a non-privileged user after opening the sockets needed for this.

The server should support the full standard DNS queries following the rfcs 1034 and 1035. As of version 1.0.0, the rfc compliance has been improved again, and pdnsd is now believed (or hoped?) to be fully rfc-compatible. It completely follows rfc 2181 (except for one minor issue in the FreeBSD port, see the documentation). It does not support the following features, of which most are marked optional, experimental or obsolete in these rfcs:

Inverse queries
Status queries
Completion queries
Namespaces other than IN (Internet)
AXFR and IXFR queries (whole zone transfers); since pdnsd does not maintain zones, that should not violate the standard

The following record types, that are extensions to the original DNS standard, are supported for caching since version 1.2.9 (if you do not need most of them, you can disable runtime support for the unneeded ones before compiling pdnsd and save a little cache and executable space, see the source file src/rr_types.in):

RP (responsible person, RFC 1183)
AFSDB (AFS database location, RFC 1183)
X25 (X25 address, RFC 1183)
ISDN (ISDN number/address, RFC 1183)
RT (route through, RFC 1183)
NSAP (Network Service Access Protocol address , RFC 1348)
PX (X.400/RFC822 mapping information, RFC 1995)
GPOS (geographic position, deprecated)
AAAA (IPv6 address, RFC 1886)
LOC (location, RFC 1876)
EID (Nimrod EID)
NIMLOC (Nimrod locator)
SRV (service record, RFC 2782)
ATMA (ATM address)
NAPTR (URI mapping, RFC 2168)
KX (key exchange, RFC 2230)
CERT (Certificate record, RFC 4398)
DS (Delegation Signer, RFC 4034)
RRSIG (Resource Record Signature, RFC 4034)
NSEC (Next Secure, RFC 4034)
DNSKEY (record containing the public key for a zone, RFC 4034)
NSEC3 (Next Secure version 3, RFC 5155)
NSEC3PARAM (NSEC3 parameters, RFC 5155)

Note: This list is incomplete. For the complete list see the source file src/rr_types.in.

There are FreeBSD and OpenBSD ports available for pdnsd (ports/net/pdnsd for both). Thanks go to Roman Shterenzon for the FreeBSD port Sebastian Stark for the OpenBSD one! Thanks to Kiyo Kelvin Lee now also runs on the Cygwin platform! Thanks goes to Rodney Brown for extending portability to the Darwin (Apple Mac OS X) platform!

If you have questions left, you should take a look into the FAQ.
Bugfixes, patches and compatability fixes for other OSs are very welcome!

Features in detail

This section describes some of pdnsds features in detail. Most of the options are set in the config file. For more information on the configuration file, see the documenation page.

Uptests

pdnsd provides several methods to test whether a remote DNS server should be regarded as available (so that pdnsd can query it), in addition to the obvious "none" test (the server is always regarded as available, or availability is set on or off using the pdnsd-ctl utility). These tests are:

ping: a given adress is ping'ed in a given interval. If it there is no response or the host is unreachable, the server is seen to be not available (for those who don't know: pinging is sending a certain Internet packet type to a host to which any standard-conformant host is required to reply).
if: a given network interface is tested whether it is existent, up and running. If it is not, the server is regarded to be not available. This is especially useful for ppp and similar interfaces. A special case test for Linux isdn (ippp*) interfaces is integrated, so that the uptests should also work for these.
dev: this is a variant of the if uptest for use with Linux dial-on-demand ppp interfaces. In addition to performing an if-style interface uptest, it also tests whether a specified program (e.g. pppd) owns a lock to a given (modem-) device.
exec: a given shell command line is executed and the exit status of the whole command line (which is normally the exit status of the last command) is evaluated. If it is not zero, the server is regarded to be not available. This is a very flexible testing method with which it should be able to perform virtually any needed test.
query: New in version 1.2: This works like the ping test, except it sends an (empty) DNS query to the remote server. If the server sends a well-formed response back within the timeout period (except SERVFAIL), it will be regarded as available. This test is useful if a remote server does not respond to ICMP_ECHO requests at all, which unfortunately is quite common these days. In many cases this test will be a more reliable indicator of availability than the ones mentioned above.

Local Records ("Zones")

As mentioned above, there are only very basic local record types (ie the record types that you may use in record declarations in your local configuration for records that pdnsd shall serve in addion to the cached ones). They are organized roughly in zones but have not complete zone declarations, so I generally do not use the term "zone" for them, but rather "local records". These are the local record types pdnsd can understand:

SOA (information about the name server)
A (domain-name-to-address mapping)
PTR (pointer, used normally for address-to-domain-name mapping)
NS (name server, generated automatically by pdnsd for any local record set)
CNAME (canonical host name)
MX (mail exchange for the domain)
TXT (arbitrary text strings, often used for Sender Policy Framework)

You can specify these records in the configuration file.
You may "source" a file in a format like that used in the /etc/hosts file, that means that pdnsd reads this file, extracts addresses and domain names from it and automatically generates A records for name to address mapping, PTR records for address to name mapping and NS records (name server specifiation) for each entry in the file.
Records can also be changed dynamically at run time.
A script contributed by Marko Stolle makes pdnsd usable in a DHCP setup using this feature.

System requirements

As mentioned, pdnsd currently runs under Linux, FreeBSD and Cygwin. Other BSD flavours may or may not work (feedback is very welcome!). The system and software requirements under Linux are:

Kernel version >2.2.0
glibc version >2.0.1 (aka libc6) with LinuxThreads (normally included) or NPTL (Native Posix Thread Library, recommended).
Due to a bug, pdnsd 0.9.8 does not run with glibc2.1.1. This behaviour was fixed in pdnsd 0.9.9.
For IPv6: glibc>=2.1

The system requirements under FreeBSD are:

FreeBSD versions >=2.6 (prior ones may or may not work)
For IPv6: FreeBSD >=4.0 is recommended (no idea if it runs on prior versions)

The common software requirements for all supported systems are:

GCC, preferably egcs-2.* or 3.* (other compilers are currently not supported; the needed patch for another compiler should not be difficult, however)
GNU or BSD make
the standard commands install, grep, sed, awk, touch and which (along with the REALLY standard ones mv, cp, ln, rm, pwd, test, echo, cat, mkdir, chown, chmod, tar). In any standard Unix installation, this should be no problem.
for hacking and building own packages, you might also need gzip, bzip2, perl and rpmbuild

Download

If you want to download pdnsd, please visit the download page.

Authors

pdnsd was originally written by Thomas Moestl, but is no longer maintained by him. Paul A. Rombouts has revised large portions of the code and has added a number of new features. See README.par and the ChangeLog in the source directory (or /usr/share/doc/pdnsd-<version> if you have installed a binary package) for more details. If you have questions about the recent modifications, you can find the email address of the current maintainer at the end of README.par.

Daniel Smolik has contributed RedHat RPMs (the most recent RPMs are available here).
Torben Janssen contributed start scripts for Red Hat Linux.
Soenke J. Peters contributed patches and suggestions for Red Hat compatability.
Wolfgang Ocker has contributed the code and documentation for the server_ip option.
Markus Mohr contributed a Debian rc script.
Nikita V. Youschenko contributed extensions to the "if" uptest.
Lyonel Vincent extended the serve_aliases option to support an arbitrary number of aliases.
Sourav K. Mandal wrote the autoconf scripts and contributed many fixes and suggestions.
Stephan Boettcher contributed the SCHEME= option.
Ron Yorston contributed the uptest for Linux ppp dial-on-demand devices.
Alexandre Nunes fixed some bugs in the autoconf files.
Sverker Wiberg contributed fixes for IPv6.
Carsten Block contributed configure-able rc scripts.
Olaf Kirch contributed a security fix for the run_as code.
Paul Wagland contributed various patches for bind9-compatability and other issues.
Roman Shterenzon contributed patches and lots of helpful hints for FreeBSD compatability.
Bernd Leibing has contributed spec file fixes.
Michael Wiedmann has contributed the pdnsd-ctl.8 man page.
Marko Stolle has contributed the contrib/pdnsd_update.pl script that makes pdnsd usable in a DHCP setup.
P.J. Bostley has contributed patches to get pdnsd working on alpha properly.
Christian Engstler contributed patches for SuSE compatability.
Bjoern Fischer contributed code to make pdnsd leave the case of names in the cache unchanged.
Marko Stolle contributed the contrib/pdnsd_update.pl script that makes pdnsd usable in a DHCP setup.
Andrew M. Bishop contributed the support for the label server option and the pdnsd-ctl interface for using it.
Frank Elsner contributed rc script fixes.
Andreas Steinmetz contributed the code for query_port_start and query_port_end options.
Mahesh T. Pai contributed the pdnsd.8 man page.
Nikola Kotur contributed the Slackware start-up script.
Kiyo Kelvin Lee contributed a patch for Cygwin support.
Rodney Brown contributed a patch for Darwin (Apple Mac OS X) support.
Jan-Marek Glogowski contributed a patch implementing the use_nss option.

Special thanks to Bert Frederiks for letting me do a late-night debugging run on his machine to spot obscure bugs!

Thanks to the following persons for reporting bugs and being helpful:
David G. Andersen,
Dirk Armbrust,
Daniel Black,
Kevin A. Burton,
Juliusz Chroboczek,
Joachim Dorner,
Stefan Erhardt,
Stefan Förster,
Mike Hammer,
Jonathan Hudson,
Dan Jacobson,
Byrial Jensen,
Patrick Loschmidt,
James MacLean,
Fraser McCrossan,
Michael Müller,
Erich Reitz,
Brian Schroeder,
Milan P. Stanic,
Michael Steiner,
Norbert Steinl,
Markus Storm,
Michael Ströder,
Alan Swanson,
Eelco Vriezekolk.

Links

Well, this is the obligatory link section.

The GNU homepage	Freecode (formerly Freshmeat) - large free software index
The FreeBSD project

Thomas Moestl and Paul A. Rombouts

Last revised: 17 March 2012 by Paul A. Rombouts